Contents

Common Uses

Spy on other users and collect sensitive information such as passwords.

Detection of network sniffers

Passive sniffing

Generally, it is impossible to detect passive sniffing programs.

Detecting promiscuous mode

It is possible to detect network interfaces in promiscuous mode by sending requests (ICMP, ARP, etc) with destination IP address of a suspect machine and wrong destination MAC address. Network interfaces in promiscuous mode will pass this request and a suspect machine will reply (network interfaces in non-promiscuous mode will drop this packet).

Detecting reverse DNS lookup requests

Some sniffing programs do automatic reverse DNS lookups on the IP addresses they see. It is possible to detect such programs by correlating network traffic and reverse DNS lookup requests.

Active sniffing

Many sniffing programs provide special techniques to intercept traffic on a switched network:

ARP spoofing;

Fake DHCP server;

ICMP redirection.

As well as the ability to sniff encrypted data:

Man-in-the-middle attacks.

These active sniffing techniques can be detected in various ways.

Cheating network sniffers

IP fragmentation

Some sniffing programs cannot handle IP fragmentation correctly.

Shortcomings in TCP reassemblers

It is possible to cheat some TCP reassemblers by sending TCP packets with low IP TTL values (this TCP packet may not reach the destination host, but will be analysed by a network sniffer). This will break the resulting TCP stream.